Daily Cybersecurity Briefing — November 4, 2026

Wednesday, November 4, 2026 | PBCS.NYC Daily Cybersecurity Intelligence | Covering the past 24–48 hours

ACTIVELY EXPLOITED VULNERABILITIES

• CVE-2026-119977 | WordPress Core | TOCTOU Race Condition → Unauthenticated RCE | CVSS 8.1 | CISA KEV Added: Nov 3, 2026 | FCEB Patch Deadline: Nov 6, 2026. During upgrades, WordPress extracts packages to web-accessible temp directories; attackers execute PHP via staged setup-config.php before cleanup. Fixed in WordPress 7.1.4 (Oct 28, 2026). 58,693+ blocked attacks in 24 hours. Affects branches 4.7–7.1.3.

• CVE-2026-13684 (CVSS 9.8) + CVE-2026-13639 (CVSS 9.8) | Synology DiskStation Manager (DSM) | Improper Output Encoding / Insufficient Entropy in login logic | Actively exploited by C3RB3R ransomware. Encrypts files with '.L0CK3D' extension; drops ransom note 'read-me3.txt'. Update DSM immediately per Synology_SA_26_13.

• CVE-2026-116606 (CVSS 9.3) + CVE-2026-111560 (CVSS 8.6) | Barracuda Email Security Gateway / WAF Control Center | Pre-auth Authorization Bypass chained with Command Injection → Root access. No active exploitation reported. Restrict admin interfaces to trusted internal networks.

• CVE-2026-109618 / CVE-2026-109619 (CVSS 9.2) | Palo Alto PAN-OS | PHP2Shell RCE chained with Fragnesia Linux LPE (CVE-2026-46300) | 25 PAN-OS systems compromised in targeted campaign; persistent reverse SSH tunnels established in a US government-affiliated environment; directory-service credentials harvested.

• CVE-2026-107239 | Veeam Backup and Replication | CVSS 9.8 | Actively exploited in the wild. Patch immediately — Veeam is a frequent ransomware precursor target.

• CVE-2026-118306 | Google Chrome | Sandbox Escape | CVSS 8.8 | Actively exploited in the wild. Apply latest Chrome/Chromium updates.

• CVE-2026-106378 | Google Chrome | Remote Code Execution | CVSS 9.6 | Proof-of-concept published. Update Chrome enterprise fleets immediately.

• CVE-2026-58868 | Android Framework | Critical RCE requiring zero user interaction | November 2026 Android Security Bulletin patches 216 total vulnerabilities. Apply security patch level 2026-11-01 immediately across mobile fleets.

• CVE-2026-112816 | Canonical LXD | Full Container Escape → Host Root | CVSS 10.0 | No public exploit yet. High priority for multi-tenant cloud and container environments.

BR3ACHES

• 'Key Eater' Campaign — 27 Organizations Breached: Attackers used stolen Microsoft Entra ID app credentials (no CVE exploited) to authenticate as legitimate applications and sweep 15 MSP customer tenants in 10-second automated loops. Victims span government, energy, agriculture, transportation, engineering, legal, education, and nonprofit sectors. 2,279 mailbox items accessed, 81 files exfiltrated, 29 wildcard Graph tenant searches. Loot: password lists, private keys, VPN profiles, MFA/RMM API keys, firewall configs, service-account maps. Operator IP: 199.19.77.84. Active since Nov 1, 2026.

• 3AM Ransomware — UK School Network: 47 systems (21 servers, 8 domain controllers) encrypted via AI-assisted attack. Used modified Veeam backup scripts, Mimikatz (disguised as sysmon64.exe), and created rogue domain admin accounts 'library' and 'svc_bkpmon'. Data staged and exfiltrated via HTTP POST on Sept 15; domain trust abuse Sept 18; encryption 05:07–05:33 UTC. System-state backups wiped.

• C3RB3R Ransomware — Synology NAS Attacks: Devices running outdated DSM versions being encrypted with '.L0CK3D' extension. Ransom note 'read-me3.txt' dropped in every encrypted directory. Skips BAT, DLL, EXE, LNK, MSI, SYS files.

• Keystone Hardware Wallet: 25,964 customer records and 12,873 checkout records exposed via compromise of a third-party device monitoring tool. Includes hardware wallet owner PII.

• Polymarket Crypto Platform: ~$2.7M drained from 33 deposit wallets in under one hour after DebugBear DNS records were hijacked and crypto-draining JavaScript injected into the trading platform.

THREATS & POLICY

• Google Dismantles XCPE Botnet, Bans Videostrong: 1.3M+ compromised IoT devices (Android TV set-top boxes, telehealth equipment, karaoke machines, digital signage). Google Threat Intelligence Group alleges Videostrong deliberately installed post-sale backdoors and sold access to criminal affiliates for ad fraud and traffic routing. Coordinated with Japan's National Police Agency. Disruption affects 10M+ additional compromised devices.

• TraderTraitor (DPRK): Alleged theft of $6.43 billion in cryptocurrency from Binance across 11 blockchains — cited as a record-breaking state-sponsored crypto theft.

• Volt Typhoon (China-nexus) — 'Silent Train': Covert relay infrastructure built from compromised SOHO, IoT, and enterprise devices being used to stage zero-day attacks against US and allied critical infrastructure while masking the true origin.

• Gheist Campaign (Wiz Research): GitHub Actions secrets exfiltration campaign — 850+ accounts compromised, 13,500+ malicious branches planted to extract CI/CD pipeline secrets.

• Device-Code Phishing Wave: MadApe and similar toolkits harvesting Microsoft Azure authentication tokens. Teams-based vishing grants Quick Assist remote access; AD Certificate Services (AD CS) exploited for persistent privileged access and lateral movement.

• EU AI Act Now Fully Enforceable: Compliance obligations now in force for organizations deploying AI systems in EU-regulated markets including risk management requirements, transparency mandates, and incident reporting obligations.

CLOUD & SAAS SECURITY

• 'Key Eater' MSP Amplification: Attackers pivoting from stolen Entra ID app secrets through ARM → Key Vault → Graph → Storage → Cognitive Services token chains in seconds. One multi-tenant app swept 15 customer tenants in automated 10-second loops. 95% of sign-ins from scripted clients. Post-detection evasion: spoofed browser user-agents and replayed refresh tokens across 25+ tenants.

• Gheist CI/CD Attack: Over 13,500 planted GitHub repository branches used to extract GitHub Actions secrets — a supply chain attack vector targeting cloud build pipelines.

• CVE-2026-112816 | Canonical LXD Container Escape | CVSS 10.0: Full privilege escalation from containerized workload to host OS. Threatens multi-tenant cloud deployments. No public exploit yet — patch immediately when available.

• OAuth Worm SaaS Attack Vector: Attackers using OAuth abuse and token replay to bypass MFA and gain persistent cross-tenant access in SaaS environments without compromising user credentials directly.

IDENTITY & AUTHENTICATION

• Device-Code Phishing Surge (MadApe): Microsoft Azure auth tokens harvested via Teams-based vishing. Victims tricked into granting Quick Assist remote access; attackers abuse Active Directory Certificate Services for persistent privileged access. Conditional Access policies blocked replayed token attempts in 'Key Eater' campaign on Nov 3.

• AI Platform Session Token Theft (WardenStealer + Aoki): 130,000+ WardenStealer (Rust MaaS) infections since August 2026 harvesting ChatGPT, Claude Desktop, Claude Code, Cursor, and GitHub Copilot credentials — including OAuth tokens, API keys, MCP server secrets, and CLAUDE.md project files. Stolen AI subscriptions sold at 40–91% discounts. CRITICAL: Changing your password alone does NOT revoke session cookies or OAuth tokens. Revoke all sessions and rotate all API keys.

• Cursor Marketplace Supply Chain Attack: Tampered Claude Code extension published to Cursor Marketplace installed SSH backdoors on 5,000+ developer systems. Malicious updates distributed via trusted marketplace infrastructure.

MOBILE SECURITY

• CVE-2026-58868 | Android Framework | Critical RCE — Zero User Interaction Required | CVSS Critical. November 2026 Android Security Bulletin patches 216 total vulnerabilities. Apply security patch level 2026-11-01 immediately across all Android mobile fleets.

• uCreator Android Spyware: Distributed via sideloaded repackaged legitimate apps; intercepts WhatsApp, Telegram, and WeChat communications in real time. Primarily targets users in Southeast Asia and China.

• CyberDakait Android Banking Trojan: 17,960 devices compromised; 7.6 million SMS messages intercepted from Indian banking customers — capturing one-time passwords and authentication codes.

• DeadTag iOS Zero-Click Spyware (Coruna / DarkSword): UNC6353 and UNC6691 (Chinese threat actors) hijacking expired ad-industry domains and injecting malicious tracking tags on sites with ~135M monthly visits. Targets iOS crypto wallet apps (Binance, Coinbase Wallet, OKX, Trust Wallet, Exodus) across European iOS devices via PrestaShop exploit chain.

ICS/OT/IoT

• XCPE Botnet Dismantled — 1.3M+ IoT Devices Compromised: Android TV set-top boxes, telehealth equipment, karaoke machines, and digital signage weaponized for ad fraud, traffic routing, and malware delivery. Google + Japan NPA disrupted infrastructure supporting 10M+ additional compromised devices.

• EPICS Base ICS Framework: CVE-2026-114595 (CVSS 9.8) and CVE-2026-114596 (CVSS 8.2) — widely deployed in research reactors, particle accelerators, and national laboratory control systems. No public exploit yet; treat as high priority.

• Volt Typhoon 'Silent Train' — Critical Infrastructure Threat: SOHO routers, IoT devices, and enterprise equipment being compromised into covert relay nodes to mask state-sponsored zero-day attacks against US and allied critical infrastructure operators.

• CISA 2026 OT Security Campaign: Agency urging all critical infrastructure operators to prioritize OT security hardening, operational continuity planning, and recovery capabilities as nation-state attacks on ICS/OT systems accelerate.

RESEARCH & TOOLS

• CVE-2026-112816 | Canonical LXD | CVSS 10.0 | Full container escape to host root. No public exploit yet. Priority patch for cloud environments.

• CVE-2026-111585 | TeamViewer | Integer Overflow in screen decompression → Heap Overflow RCE | CVSS 8.8 | Proof of concept published. Patch immediately — widely deployed remote access tool.

• CVE-2026-18672 + CVE-2026-19219 | Progress Telerik UI for ASP.NET AJAX | File read chained to RCE | CVSS 7.5 + 8.1 | PoC available. Widely deployed in enterprise .NET web applications.

• CVE-2026-115889 / CVE-2026-115893 | Wasmtime WebAssembly Runtime | CVSS 9.9 (both) | Critical bugs in Rust-based Wasm runtime used in serverless and edge computing platforms. No public exploit yet.

• CVE-2026-97631 | TianoCore EDK II UEFI Firmware | Secure Boot Bypass | CVSS 9.5 | Affects enterprise motherboard firmware; successful exploitation enables persistent pre-OS malware. No public exploit yet.

• CVE-2026-115547 | Okta Access Gateway | CVSS 9.1 | Affects enterprise SSO access gateway. No public exploit yet. Apply available patches.

• Aviatrix November 2026 Weekly CVE Roundup: 20+ critical CVEs documented across cloud, container, middleware, and ICS infrastructure — including Apache Kafka (CVE-2026-114349, CVE-2026-111551), HashiCorp Consul-k8s (CVE-2026-110720, CVSS 9.9), Fireblocks MPC-lib (CVE-2026-90975, CVSS 9.1), Linux kernel (CVE-2026-98432, CVSS 9.8), and GoAhead web server TLS issues.

AI/ML SECURITY

• AI Session Token Theft Surge: WardenStealer (Rust-based MaaS) and Aoki (Go-compiled) infostealers actively harvesting ChatGPT, Claude Desktop, Claude Code, Cursor, and GitHub Copilot credentials. 130,000+ WardenStealer infections since August 2026. Stolen subscriptions selling at 40–91% discounts. CRITICAL: Password resets do NOT revoke session cookies or OAuth tokens. Must revoke sessions and rotate all API keys from a clean system.

• Cursor Marketplace Supply Chain Attack: Tampered Claude Code extension installed SSH backdoors on 5,000+ developer systems. Malicious updates distributed via trusted marketplace. Developers trusting curated marketplaces remain at risk from supply chain compromise.

• Hugging Face Malicious Model Repos: Attacker-controlled model repositories executing arbitrary code via trust_remote_code=True parameter. Ongoing ML supply chain risk — always verify model provenance and sandbox execution before loading in production.

• AI-Assisted Ransomware Operations: Bitdefender analysis (Nov 3, 2026) documents suspected LLM-aided attack automation in 3AM ransomware campaign — evidenced by incorrect API syntax, Unix-style commands on Windows, and numbered script revisions. Sophos separately flags Aur0ra ransomware for AI-assisted development and execution.

• CVE-2026-93680 | Langflow OSS (AI workflow orchestration tool) | CVSS 9.8 | Critical vulnerability in widely-used open-source AI pipeline framework. No public exploit yet. Restrict Langflow instances from internet exposure; apply patches immediately.

• LLMjacking Indicators in 'Key Eater': 4 Azure Cognitive Services (AI) tokens issued across two compromised MSP tenants during the 'Key Eater' campaign — potential unauthorized AI API consumption (LLMjacking). Total AI usage costs and consumption not yet confirmed by investigators.

• EU AI Act + CISA/NSA Guidance: EU AI Act enforcement now fully active — compliance obligations in force. CISA and NSA continue issuing joint AI security guidance for critical infrastructure operators deploying AI-driven automation and decision systems.

SOURCES

CISA KEV Alert (Nov 3, 2026): https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog

The Hacker News — WordPress CVE-2026-119977: https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html

GBHackers — WordPress CISA Warning: https://gbhackers.com/cisa-warns-of-wordpress-core-code-execution-vulnerability

The Hacker News — Synology C3RB3R Ransomware: https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html

The Hacker News — Barracuda Chained Flaws: https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html

GBHackers — 3AM Ransomware UK Schools (AI-Assisted): https://gbhackers.com/3am-ransomware-hackers-use-ai-assisted-attacks-to-breach-uk-schools/

GBHackers — Key Eater / Microsoft Entra ID Breach: https://gbhackers.com/hackers-use-stolen-microsoft-entra-id-app-credentials

GBHackers — AI Session Token Theft (WardenStealer/Aoki): https://gbhackers.com/ai-sessions-hijacked

Broadband TV News — Google/Videostrong XCPE Botnet: https://broadbandtvnews.com/2026/11/04/google-bans-videostrong-after-dismantling-set-top-box-botnet

F5 Labs Weekly Threat Bulletin (Nov 4, 2026): https://www.f5.com/labs/articles/weekly-threat-bulletin-november-4th-2026

Aviatrix Threat Research — Weekly Recap Nov 2026: https://aviatrix.ai/threat-research-center/weekly-recap-critical-cves-linux-ddos-botnet-device-code-phishing-android-spyware-2026/

Rescana — Android CVE-2026-58868 Analysis: https://www.rescana.com/post/android-security-bulletin-november-2026-cve-2026-58868-prepare-now

Security Affairs — Android CVE-2026-58868: https://securityaffairs.com/202414/mobile-2/cve-2026-58868-critical-android-bug-could-let-attackers-run-remote-code.html

SC World — EU AI Act Enforcement: https://scworld.com/perspective/the-eu-ai-act-has-entered-the-real-world-what-organizations-need-to-do-now

Industrial Cyber — CISA OT Security Campaign 2026: https://industrialcyber.co/cisa/cisa-urges-critical-infrastructure-owners-to-prioritize-ot-security-operational-continuity-recovery-planning-in-2026-campaign

CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog